December 10, 2024
Written by Amelia Vance, Founder & President, Public Interest Privacy Center *This blog is shared with permission from PIPC, the team that collaborates with AASA and AESA on advocacy efforts.
As you may recall–the Senate passed the Kids Online Safety and Privacy Act (KOSPA) in July, incorporating two major student and child privacy bills–the Kids Online Safety Act (KOSA) and the Children and Teen’s Online Privacy Protection Act (COPPA 2.0). The House Energy & Commerce Committee passed different versions of KOSA and COPPA 2.0 in September, leaving questions about how these bills would proceed.
We’ll be going through this version of KOSPA–which was released as an amendment in the nature of a substitute (AINS)–in detail over the next few days. So far, we’re happy to see that Title I (KOSA) includes an exception requiring covered platforms to provide certain safeguards and parental tools directly to the school when the platform is acting on behalf of the school under a contract that complies with COPPA and FERPA. This would alleviate our concerns about parents being able to turn off privacy safeguards schools negotiate with edtech vendors or completely delete student’s accounts on edtech platforms used in school. However, since the exception is within brackets, it is uncertain whether it will be included in the final KOSPA AINS.
We are also glad to see that Title II (COPPA 2.0) has not changed. As a reminder: PIPC has endorsed COPPA 2.0. COPPA 2.0 would ensure that schools retain the legal authority to consent to data collection and use on behalf of parents in educational contexts if the technology services are solely for the use and benefit of the school and for no other commercial purpose. School districts have consistently relied on the FTC’s COPPA FAQs and the FTC’s Statement of Basis and Purpose to the 1999 COPPA Rule to consent to such technology uses. This long-standing administrative authority has not yet been codified into federal statute, and the FTC’s efforts to codify this authority in regulations (as proposed by the recent NPRM) are uncertain. COPPA 2.0 would solidify this fundamental administrative and educational function for school districts, safeguarding their ability to effectively incorporate privacy-protective edtech into the classroom.
Here are some other key changes to Title I (KOSA) that we’re seeing in this version of KOSPA:
- The duty of care to prevent harm to minors has been significantly narrowed, now including a standard “where a reasonable and prudent person would agree that such harms were reasonably foreseeable by the covered platform and would agree that the design feature is a contributing factor to such harms” and a more tailored list of harms.
- While the prior version of KOSPA called for the FTC to issue guidance about covered platforms conducting market research on minors, disaggregated by the age ranges of 0-5, 6-9, 10-12, and 13-16, the KOSPA AINS prohibits conducting market or product-focused research on users they know are children and requires verifiable parental consent (as defined under COPPA) before conducting such research on minors.
Notably, several of the constitutional concerns in KOSA may be addressed in this version of KOSPA. According to a press release from Senators Blackburn and Blumenthal, “changes were made to further make clear that KOSA would not censor, limit, or remove any content from the internet, and it does not give the FTC or state AGs the power to bring lawsuits over content or speech, no matter who it is from” and “The bill passes First Amendment scrutiny because it is content neutral.” We recommend this article from TechPolicy.press for a refresher on some of the First Amendment issues at play.
Stay tuned for more information as we keep digging into the KOSPA AINS (including how the bill’s language about transparency may address other First Amendment concerns raised by recent court cases). We’ll keep you updated on our analysis as it develops.